Wireshark-dev: [Wireshark-dev] regarding the output of "Follow TCP Stream" command
Hi All,
Is the output of "Follow TCP Stream" command, with the "Entire Conversation" option in drop-down list selected, strictly ordered ?
I am guessing that it is not.
As far as I know, this is theoritically not possible since as an observer in the middle of the communication, it is impossible to know which end of a connection sends a certain data first. In some cases, the two streams coming from each end of a connection may be totally independent of each other.
Can someone please verify this information ?
Thanks.